How does one find if a multisite data bucket is primary and its site id?

[tianchen]

Hi,

Is there a way to verify what the primality status (whether the bucket is primary) and the site affinity of a multisite bucket?

Where are those values stored relative to the bucket?

[dxu_splunk · Accepted solution]

check out

https://master_uri:mgmt_port/services/cluster/master/buckets/BUCKET_ID

there should be a primary_by_site listing, stating which peer (by GUID) is returning results for each site. site affinity should guarantee that a site1 peer is primary_by_site for site1, site2 peer is primary for site2, etc... (assuming theres a bucket present on the site of course)

[tianchen]

Thanks dxu. That's good to know.

What if one has this use case to change the siteid for a bunch of buckets to migrate it to another site?
Is that possible to do?

Is there a way to find that information physically on the file system?

I was curious as to where rebuild-bucket-manifest gets all that information to regenerate the manifests.

The same with the primality mask. Wonder if that's also stored somewhere just in case one would like to dive deeper in troubleshooting..

Thanks again.

[dxu_splunk]

The primaries (primality-mask) are maintained on the Cluster Master, and they can change (for a particular bucket) from time to time (sometimes we'll rebalance the primaries so that each indexer has a similar # of primary buckets). Theres currently no command to force the master to make specific changes of it.

We also can't change where the bucket originated from (origin-site), since its embedded in the rawdata file of a bucket.

[tianchen]

Ok I see what you mean now. Thanks for the enlightening insight Da Xu.

Looks like best way to move it is to delete the peer and stand it up under the new site.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Moveapeertoanewsite